CVE-2015-4411: Potential denial of service in bson rubygem
Summary
CVE-2015-4411: BSON rubygem contains potential denial of service. Affects bson versions < 3.0.4. Fixed in 3.0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bson rubygem is a library used in RubyGems ecosystem for working with BSON (Binary JSON) data. BSON is a binary representation of JSON-like documents and is commonly used in MongoDB. The Moped::BSON::ObjecId.legal? method in the bson rubygem before version 3.0.4, as used in the rubygem-moped, allows remote attackers to cause a denial of service by consuming excessive worker resources. This vulnerability is a result of an incomplete fix to CVE-2015-4410.
Vulnerability Detail
The vulnerability in the bson rubygem allows remote attackers to exploit a denial of service vulnerability by sending a crafted string. This can lead to excessive consumption of worker resources, impacting the availability and performance of the affected system. The issue arises due to a flaw in the Moped::BSON::ObjecId.legal? method, which fails to properly handle certain inputs. As a result, an attacker can trigger this vulnerability by sending a specially crafted string, causing the system to consume excessive resources and potentially leading to a denial of service condition.
How To Fix
Minimum fixed version
3.0.4
This is the first release that contains the fix.
gem install bson -v 3.0.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is highly recommended to upgrade to the fixed version of the bson rubygem as soon as possible.
Conclusion
The bson rubygem is vulnerable to a denial of service vulnerability that can be exploited remotely. To mitigate this issue, it is crucial to upgrade to version 3.0.4 or later of the bson rubygem. This will ensure that the vulnerability is properly fixed and prevent potential resource consumption attacks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bson →
FAQ
This vulnerability can be exploited by remote attackers to cause a denial of service, potentially leading to system unavailability and performance degradation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just a manifest file like package-lock.json.
There are no known instances of this vulnerability being exploited in the wild at this time.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity.
For more information about this vulnerability, you can refer to the GitHub advisory at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/04/GHSA-qh4w-7pw3-p4rp/GHSA-qh4w-7pw3-p4rp.json
References
Related vulnerabilities
Recent vulnerabilities recorded for bson.
